{
  "case": "2018-09-27",
  "captured_at": "2026-09-22T19:41:12.684Z",
  "url": "[local-instance]",
  "analysis_id": "0e0621ff-1831-43a5-b884-8ae7b2febaf3",
  "summary_id": "investigation-summary:1e80b94a-c04d-4688-b0ee-efdabd2760e1",
  "model": "gpt-4.1-2025-04-14",
  "capture_sha256": "460b5e968641264ffb63486cfe2c6586c0db9e19fcc047175c978009eaa94d7b",
  "native_summary_saved": true,
  "source_sha256": "9bb0de3408b8ee7b3023246049ddd0af44a770b430045b69f5f097168020f253",
  "screenshot_sha256": "eae5a9c300048e1f90e32220ff41d9056a5c8ed525c5b5d581937313ec470f3e",
  "all_claim_texts_present": true,
  "live_summary_matches_saved": true,
  "stale": false,
  "width": 1100,
  "height": 738,
  "overflow": [],
  "narrativeFont": "17px",
  "text": "ADVERSARYGRAPH · PCAP INVESTIGATION\nANALYST REVIEW REQUIRED\nWhat happened in this capture?\n\n2018-09-27-traffic-analysis-exercise.pcap\n\nThe host Escritorio-PC (172.16.5.203) participated in standard Kerberos authentication and directory protocol activity within a local network, involving accounts such as thiago.almeida and escritorio-pc$.\n\nDirectory protocol operations (LDAP, SAMR, DRSUAPI) were observed between Escritorio-PC and a domain controller (172.16.5.5), but this traffic matches normal Windows logon and user activity, with no evidence for credential theft, discovery, or DCSync.\n\nWho was involved\nThe host Escritorio-PC (172.16.5.203) is associated with the accounts thiago.almeida and escritorio-pc$.\nThe account thiago.almeida is present as a Kerberos client principal.\nThe hostname Escritorio-PC is used by the device at 172.16.5.203.\nWhat remains uncertain\nThere is no evidence of suspicious payload transfers, malware execution, or data exfiltration in this capture.\nNext check\nIf investigation is warranted, review endpoint logs on Escritorio-PC for anomalies not detectable in network traffic alone.\n\nModel: gpt-4.1-2025-04-14 · 123 claim-text words · 2026-09-22 · pcap-investigation-summary-v5\n\nCapture SHA-256: 460b5e968641264ffb63486cfe2c6586c0db9e19fcc047175c978009eaa94d7b\n\nExact citations and reputation coverage are available separately. A downloaded file is not proof of execution.",
  "browser_errors": [],
  "overlapping_fixed_elements": [],
  "visual_review": {
    "status": "passed",
    "reviewer": "assistant visual image inspection",
    "reviewed_at": "2026-09-22T19:50:59.812391+00:00",
    "image_sha256": "eae5a9c300048e1f90e32220ff41d9056a5c8ed525c5b5d581937313ec470f3e",
    "notes": "Individually viewed final card: narrative and labels legible, long hash wraps inside card, full provenance footer, no overlap or clipping. Content accuracy separately evaluated against publisher answers.",
    "scope": "Image presentation only: readable text, complete frame, consistent case identity, no overlap/clipping. Investigation correctness is evaluated separately against evidence and answers."
  }
}